|Publication number||US7895478 B2|
|Application number||US 11/885,294|
|Publication date||Feb 22, 2011|
|Filing date||Dec 30, 2005|
|Priority date||Feb 28, 2005|
|Also published as||DE102005008975A1, DE502005009340D1, EP1866714A1, EP1866714B1, US20090300435, WO2006092182A1|
|Publication number||11885294, 885294, PCT/2006/57233, PCT/EP/2006/057233, PCT/EP/2006/57233, PCT/EP/6/057233, PCT/EP/6/57233, PCT/EP2006/057233, PCT/EP2006/57233, PCT/EP2006057233, PCT/EP200657233, PCT/EP6/057233, PCT/EP6/57233, PCT/EP6057233, PCT/EP657233, US 7895478 B2, US 7895478B2, US-B2-7895478, US7895478 B2, US7895478B2|
|Inventors||Ruediger Karner, Alexander Jansen|
|Original Assignee||Robert Bosch Gmbh|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (21), Referenced by (2), Classifications (10), Legal Events (1)|
|External Links: USPTO, USPTO Assignment, Espacenet|
The present invention relates to a method for monitoring a process execution and to a device for implementing the method according to the present invention.
Numerous control methods and their corresponding devices provide for regularly recording signals from sensors, for analyzing the recorded signals, and for generating appropriate control signals in response to the analysis. An example is a control system for triggering airbags which regularly executes a process that includes the following incremental steps: recording the signals from sensors, processing the signals, and generating a control signal for the airbag.
A malfunction of the real-time system or of the executed processes can lead to a triggering of the airbag. This is prevented in that the real-time system monitors the execution of the processes and, in response to detection of a malfunction, an outputting of a control signal to the airbag is blocked.
A method for clarifying a problem definition of the exemplary embodiment and/or exemplary method of the present invention is shown in
A method is devised by the exemplary embodiment and/or exemplary method of the present invention which has the features described herein and is able to be implemented by the device having the features described herein. The method according to the present invention provides for every underflow and overflow to be recorded, a reaction time, measured from a start of a faulty process to the point of outputting of an error signal, being short.
The method according to the present invention for monitoring a process execution of a plurality of sequentially executed processes starts one of a plurality of timers in cyclic permutation when one of the processes is started, and outputs a first error signal when a period of time recorded by one of the timers exceeds a predefined maximum period of time.
One advantage of the exemplary embodiment and/or exemplary method of the present invention is that a malfunction of a process, i.e., an atypically long execution duration, causes a first timer, which had been started prior to the process by a preceding process, to overflow. For that reason, measured from the start of a process, the reaction time until the malfunction of the process is recognized, is shorter than the maximum period of time.
The option of starting a timer by a process and stopping it by the same process requires selecting a longer average maximum period of time than in the method according to the present invention.
This has to do with the typical outliers of the execution duration which occur in isolated instances and should not result in an outputting of the error message. For that reason, in the case that the timer is started and stopped by the same process or is restarted by the immediately following process, the maximum period of time must be greater than the execution duration of the typical outliers. In the method according to the present invention, it is assumed that N−1 processes are executed in the typical manner and, at most, that one single process is an outlier, N being the number of timers. Thus, the excess length of the outlier is distributed over N processes, and the average maximum period of time, in terms of one single process, is shorter than in the aforementioned method that is not in accordance with the exemplary embodiment and/or exemplary method of the present invention.
Advantageous further refinements of the method set forth in claim 1 and improvements thereto are indicated in the dependent claims.
One exemplary embodiment provides that, in response to the ending of a process, a recorded period of time of the timer be read out which is restarted by the next process to be executed, and that a second error signal be output when the period of time falls below a predefined minimal period of time. This method advantageously makes it possible for a malfunction of the process execution having an atypically short execution duration of a process to be recognized.
Another embodiment provides for a test datum to be transmitted to a started process for processing purposes and, upon termination of the process, for a third error signal to be output in response to a deviation of the processed test datum from a setpoint value. In one embodiment, a process is composed of subprocesses, and at least one subprocess executes an operation on the test datum which confirms the execution of this subprocess reproducibly by the processed test datum. This makes it possible to recognize whether all relevant subprocesses have been executed in which the processed test datum is compared to the setpoint value. Another embodiment provides for at least two subprocesses to execute mutually non-commutative operations on the datum, with the result that the execution of these subprocesses is able to be confirmed in the correct sequence by the processed test datum. It is a feature of mutually non-commutative operations that an operation in a different sequence on the test datum leads, for most test data, to different processed test data.
In accordance with one exemplary embodiment, two immediately successive processes are started at a minimal time interval. This makes it possible for processes to be regularly executed.
Another embodiment provides for the maximum period of time to be greater than a first product of the minimal time interval and for the number of timers to be smaller than the sum of the first product and of the minimal time interval. Another embodiment provides for the minimal period of time to be greater than or equal to a second product of the minimal time interval and of the number of timers reduced by one.
In accordance with one specific embodiment of the present invention, a device for implementing the method includes a monitoring device which is connected to a processor device that executes the processes in order to receive a start signal from the control device when a process is started, and is configured to compare a transmitted period of time to the maximal period of time and, in response to exceeding of the same, to output an error signal via an interface; and includes at least two timers which are connected to a multiplexer of the monitoring device in order to be able to be cyclically restarted by a reset signal and are connected to an input of the monitoring device in order to transmit a recorded period of time to the monitoring device.
Another embodiment provides for the timers to have regressively operated counters which, in response to a restart, are set to a value that corresponds to the predefined maximal period of time. Another embodiment provides for the timer to be configured to enable the recorded period of time to be read out by the monitoring device and for the timer to be configured to be stoppable by a control signal.
Yet another embodiment provides for the monitoring device to have a comparator which compares the setpoint value to a test datum processed by the process and, in the case of a deviation, outputs a third error signal.
Exemplary embodiments of the present invention, as well as advantageous further refinements, are shown in the figures of the drawing and are explained in greater detail in the following description.
Although the exemplary embodiment and/or exemplary method of the present invention is described with reference to a monitoring of a process control by a real-time system, it is not limited thereto, but rather relates generally to methods for monitoring processes.
In the figures, like or functionally equivalent components are denoted by like reference numerals, provided that nothing is indicated to the contrary.
Various malfunctions may occur during the process execution by processor system S. For that reason, it is desirable to obtain indicators of a malfunction of processor system S. A very simple and nevertheless effective method provides for monitoring the execution duration of processes P1, P2, . . . . To that end,
The period of time between two restarts of one of timers ZA, ZB is read out prior to a restarting of corresponding timer ZA. In the specific embodiment shown in
Another specific embodiment provides for only stopping timer ZA upon termination of a process and for reading out this timer before it is restarted. In the case of fourth process P4, the point in time of reading out or of stopping of first timer ZA must necessarily coincide with the restarting of first timer ZA, since fifth process P5 is immediately started upon termination of fourth process P4. The performance characteristics of second timer ZB correspond to that of first timer ZA, with the exception that the process of reading out and restarting of second timer ZB is delayed by the execution time of a process.
This pattern may be applied universally to N timers ZA, ZB, . . . ZN, these timers then being started one after another in a cyclically permuted sequence, thus, following N-th timer PN, first timer P1 is restarted again. Thus, first timer ZA is restarted in response to processes P1, PN+1, P2N+1, . . . ; second timer ZB in response to processes P2, PN+2, P2N+2, . . . ; and k-th timer ZN in response to processes Pk, PN+k, P2N+k. The reading out or stopping of a k-th timer Zk is carried out in accordance with the specific embodiment of
It follows from the preceding description that not every instance of a process execution exceeding a time interval dT1, dT2 is based on a malfunction of processor system S or of executed process P3, but rather may also correspond to infrequently occurring outliers of the execution duration. For this purpose, a time buffer ΔT is introduced which corresponds to the expected excess length of the outliers. Since it is to be assumed that a typical outlier is very rare and thus only occurs once in 2 or N successive processes P1, P2, . . . , a maximum period of time TMax is defined that is longer by time buffer ΔT than 2−times or N−times time interval dT. Generally, maximum period of time TMax is longer by the time buffer than the sum calculated over all time intervals dT1, dT2 between two scheduled starts of a timer.
It is explained exemplarily with reference to
In a comparison with
Another indication of a malfunction in a processor system S is when processes are ended much more quickly than usual. It is described with reference to
Besides monitoring the processes on the basis of their execution times, another possible diagnostic method is provided by the specific embodiment illustrated with reference to
If, in a processor system S, a first process P1 is started at 200, processor control S transmits a start signal 100 to a monitoring device 2. In response thereto, monitoring device 2 starts a first timer ZA at 250, as described in the preceding exemplary embodiments. In addition, a test datum X1 is selected at 251 and transmitted via a signal 101 to processor system S. In first process P1, at least one operation f is applied to test datum X1 at 201, so that a processed test datum Y1 is thereby obtained. At termination 202 of first process P1, a stop signal 102 is transmitted from processor system S to monitoring device 2. Subsequently, in monitoring device 2, second timer ZB is stopped at 252, in order to check whether period of time B recorded by second timer ZB falls below minimal period of time Tmin at 254; and, if it has, an error message is output at 259, as already described in the preceding specific embodiments. In addition, processed test datum Y1, which was transmitted via stop signal 102, is compared to a setpoint value Ysetpoint1. In the case of a deviation, an error message is likewise output. In addition, it is checked whether a recorded period of time has not already exceeded maximum period of time TMax at 258, which likewise leads to the outputting of an error message, as already explained.
At the start of another process, the previously described steps are repeated, as can be inferred from
With reference to
With reference to
Control device S outputs a control signal to output stage 3 when airbag system 4 is to be triggered. When an error of the process execution is recognized by processing device 1, output stage 3 is blocked, thereby preventing a triggering of airbag system 4.
Another advantage of the described specific embodiments is achieved in accordance with the following. As described, the outliers require introduction of time buffer ΔT. In the context of a system having N timers Z1, Z2, . . . , time buffer ΔT is effectively distributed over N processes P1, P2 . . . . Thus, the average execution duration for each individual process is specified more precisely than when working with only one single timer Z″ and, nevertheless, isolated outliers do not lead to the outputting of an error signal.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US3723975 *||Jun 28, 1971||Mar 27, 1973||Ibm||Overdue event detector|
|US4410938 *||Apr 1, 1980||Oct 18, 1983||Nissan Motor Company, Limited||Computer monitoring system for indicating abnormalities in execution of main or interrupt program segments|
|US4748587 *||Nov 25, 1985||May 31, 1988||International Business Machines Corp.||Device for improving detection of unoperational states in non-attended driven processor|
|US5148378 *||Nov 19, 1990||Sep 15, 1992||Omron Corporation||Sensor controller system|
|US5359515||May 16, 1990||Oct 25, 1994||Robert Bosch Gmbh||Vehicle occupant safety system and method for operating the same|
|US5363303 *||Mar 18, 1994||Nov 8, 1994||Zexel Corporation||Control system for vehicle safety device|
|US5602736 *||Dec 20, 1994||Feb 11, 1997||Airbag Systems Co., Ltd||Vehicle safety system equipped with microcomputer|
|US5677838||Apr 10, 1995||Oct 14, 1997||Nippondenso Co., Ltd.||Faulty operation prevention circuit of a computer|
|US5848366 *||May 28, 1996||Dec 8, 1998||Jatco Corporation||Load driving control system for vehicle equipped with microcomputer|
|US5908470 *||Jan 3, 1997||Jun 1, 1999||Ncr Corporation||Method for contention-free access and management of timers in multiprocessing environments|
|US5938708 *||Jul 3, 1997||Aug 17, 1999||Trw Inc.||Vehicle computer system having a non-interrupt cooperative multi-tasking kernel and a method of controlling a plurality of vehicle processes|
|US5983143 *||Nov 17, 1997||Nov 9, 1999||Siemens Aktiengesellschaft||Control unit with dynamically managed timers|
|US6219598 *||Feb 11, 1998||Apr 17, 2001||Nissan Motor Co., Ltd.||Automotive controller maintaining operation of controlled device when a microcomputer overruns and cannot be reset|
|US6543003 *||Nov 8, 1999||Apr 1, 2003||International Business Machines Corporation||Method and apparatus for multi-stage hang recovery in an out-of-order microprocessor|
|US6823515 *||May 10, 2001||Nov 23, 2004||International Business Machines Corporation||Performance enhancements for threaded servers|
|US6898493 *||Mar 13, 2001||May 24, 2005||I.D. Systems, Inc.||Fully automated vehicle rental system|
|US7207043 *||Dec 31, 2002||Apr 17, 2007||International Business Machines Corporation||Programmatic response-time based workload distribution techniques|
|US7310751 *||Feb 20, 2004||Dec 18, 2007||Hewlett-Packard Development Company, L.P.||Timeout event trigger generation|
|US20020124212 *||Nov 12, 1997||Sep 5, 2002||Werner Nitschke||Watchdog circuit|
|US20040078731 *||Oct 2, 2001||Apr 22, 2004||Alwin Becher||Method for operating a processor-controlled system|
|EP0663324A1||Dec 22, 1994||Jul 19, 1995||Airbag Systems Company Ltd.||Vehicle safety system equipped with microcomputer|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US8169902 *||Feb 6, 2009||May 1, 2012||Oki Electric Industry Co., Ltd.||Wireless transmitter device and method thereof for keeping the total transmission time limited|
|US20090201906 *||Feb 6, 2009||Aug 13, 2009||Oki Electric Industry Co., Ltd.||Wireless transmitter device and method thereof for keeping the total transmission time limited|
|U.S. Classification||714/55, 714/10, 700/1, 702/125|
|Cooperative Classification||G06F11/0757, G05B19/0428, G05B2219/24125|
|European Classification||G05B19/042S, G06F11/07P2A1|